Privacy Policy

1. Who we are

Tradesfolk is a trading name of PeakWave LTD ("we", "us", "our"), a company registered in England and Wales (company number 17118746). We operate the website tradesfolk.co and are the data controller for the personal data processed through this platform.

This privacy policy explains what personal data we collect, why we collect it, how we use it, and what rights you have. It applies to all users of Tradesfolk, including tradespeople and homeowners.

For any data protection enquiries, contact us at hello@tradesfolk.co.

2. Data we collect

We collect the following types of personal data, depending on how you use the platform:

Account data

When you create an account, we collect your name, email address, and a password. Your password is securely hashed by our authentication provider (Supabase) and we never store or have access to it in plain text. You may optionally provide a phone number.

Profile data (tradespeople)

If you register as a tradesperson, we collect information to build your public profile. This includes your trade categories, qualifications, business name, bio, years of experience, profile photo, work gallery images, and public liability insurance details (whether you hold a policy, your insurer, and coverage level). You may also submit verification details such as a Companies House number or trade body membership.

Profile data (homeowners)

If you register as a homeowner, we collect your name, email address, and postcode.

Location data

We collect postcodes from both user types. We derive approximate latitude and longitude coordinates from your postcode using the postcodes.io service. This allows us to match tradespeople with nearby homeowners and jobs. We do not collect precise GPS location from your device.

Communication data

We store messages exchanged between tradespeople and homeowners through the platform, review content (including photos), vouch messages, and questions and answers posted in the community Q&A section.

Job data

When homeowners post jobs, we collect job titles, descriptions, trade categories, postcodes, photos, budget information, and urgency preferences. When tradespeople express interest, we collect quote amounts, estimated durations, and earliest start dates.

Technical data

If you opt in to push notifications, we store push subscription tokens (endpoint URL and encryption keys) to deliver notifications to your device. We also collect basic device and browser information through standard web server logs.

AI analysis data

If you use our Snap and Fix feature, we collect photos you upload for AI analysis along with the postcode you provide. The AI-generated diagnosis, trade category, scope assessment, and cost estimates are also stored.

Usage data

We collect aggregated, anonymised usage statistics such as daily profile view counts and search appearance counts for tradespeople. These help tradespeople understand how visible their profile is.

3. How we use your data

We use your personal data to:

• Create and manage your account, and authenticate you when you sign in.
• Display tradesperson profiles to homeowners searching for services in their area.
• Match tradespeople with relevant jobs and homeowners based on trade category and location.
• Facilitate messaging between tradespeople and homeowners.
• Send transactional emails such as welcome messages, job alerts, review prompts, and seasonal activity reminders.
• Deliver push notifications (if you have opted in) about new messages, job opportunities, and other platform activity.
• Provide AI-powered features such as photo diagnosis and cost estimation.
• Generate aggregated analytics for tradespeople (profile views and search appearances).
• Improve the platform, fix bugs, and develop new features.
• Prevent fraud, abuse, and misuse of the platform.
• Comply with legal obligations.

4. Legal basis for processing

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we rely on the following legal bases for processing your personal data:

• Performance of a contract - Processing your data is necessary to provide the Tradesfolk service to you, including creating your account, displaying your profile, matching you with users, and facilitating communication.
• Legitimate interests - We process some data based on our legitimate interests in improving the platform, ensuring security, preventing fraud and abuse, and understanding how the service is used. We always balance our interests against your rights and freedoms.
• Consent - Where we send you marketing communications or deliver push notifications, we do so based on your consent. You can withdraw consent at any time by updating your notification preferences or contacting us.
• Legal obligation - We may process your data where required by law, such as responding to lawful requests from public authorities.

5. Who we share your data with

We never sell your personal data. We share data only with trusted service providers who help us operate the platform:

• Supabase - Database hosting and authentication. Servers in the EU and US.
• Vercel - Website hosting and deployment. Servers in the US.
• Resend - Transactional email delivery (welcome emails, job alerts, review prompts). Servers in the US.
• Google Places API - Business search for importing external reviews (optional feature). Servers in the US.
• Google Gemini - AI photo analysis for the Snap and Fix feature. Photos you submit are sent to Google's AI service for diagnosis. Servers in the US.

All of these providers are bound by data processing agreements and have appropriate safeguards in place, including Standard Contractual Clauses (SCCs) or equivalent mechanisms approved under UK data protection law.

Certain information you provide - such as your profile details, reviews, vouches, Q&A posts, and project showcases - is publicly visible on the platform by design. This is core to how the marketplace works.

6. How long we keep your data

We keep your personal data for as long as your account is active. If you request deletion of your account, we will delete your personal data within 30 days, except where we are required by law to retain it for longer (for example, for tax or legal compliance purposes).

Anonymised or aggregated data that can no longer be linked to you (such as overall platform usage statistics) may be retained indefinitely.

Messages and reviews may be retained in anonymised form after account deletion to maintain the integrity of conversations and review records for other users.

7. Your rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access - You can request a copy of the personal data we hold about you.
• Right to rectification - You can ask us to correct any inaccurate or incomplete personal data. You can also update most of your information directly through your profile settings.
• Right to erasure (right to be forgotten) - You can request that we delete your personal data, subject to any legal obligations that require us to retain it.
• Right to restrict processing - You can ask us to limit how we process your data in certain circumstances.
• Right to data portability - You can request your personal data in a structured, commonly used, machine-readable format.
• Right to object - You can object to our processing of your data where we rely on legitimate interests as the legal basis.
• Rights related to automated decision-making - Our AI features (such as Snap and Fix) provide informational estimates and suggestions only. No significant decisions about you are made solely by automated means.

To exercise any of these rights, please email us at hello@tradesfolk.co. We will respond within one month, as required by law. There is no charge for making a request.

8. Cookies

We use essential cookies only. These are authentication session cookies set by Supabase that are required for the platform to function - they keep you logged in and maintain your session securely.

We do not use any advertising, tracking, or analytics cookies. We do not use any third-party cookie-based tracking tools.

We may use your browser's localStorage to remember UI preferences (such as display settings). This data stays on your device and is not transmitted to our servers.

9. Children

Tradesfolk is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@tradesfolk.co and we will take steps to delete that information.

10. International data transfers

Some of our service providers (Supabase, Vercel, Resend, and Google) are based in the United States. This means your personal data may be transferred to and processed in the US.

Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office, or reliance on adequacy decisions where applicable.

11. Changes to this policy

We may update this privacy policy from time to time to reflect changes in how we process your data or to comply with legal requirements. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. For significant changes, we may notify you by email.

12. Complaints

If you are unhappy with how we have handled your personal data, we would like the chance to put things right. Please contact us at hello@tradesfolk.co and we will do our best to resolve your concern.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

13. Contact us

If you have any questions about this privacy policy or how we handle your personal data, please get in touch:

Email: hello@tradesfolk.co

Operated by: PeakWave LTD (trading as Tradesfolk), registered in England and Wales, company number 17118746.